Skip to content
MalwareWiki

RAT

ZuoRAT

According to Black Lotus Labs, ZuoRAT is a MIPS file compiled for SOHO routers that can enumerate a host and internal LAN, capture packets being transmitted over the infected device and perform person

ZuoRAT is a Linux rat.

Background

Per Black Lotus Labs, ZuoRAT is a MIPS binary built for SOHO routers. It can enumerate the host and the internal LAN, sniff packets passing through the compromised device, and conduct person-in-the-middle attacks, hijacking DNS and HTTPS according to predefined rules.

Source: Malpedia (Fraunhofer FKIE).